devcouncil 0.1.0 → 0.2.0

package/src/devcouncil/gating/checks/clean_git.py

@@ -1,45 +1,52 @@
-import subprocess
-import logging
-from devcouncil.domain.gap import Gap
-
-logger = logging.getLogger(__name__)
-
-class CleanGitCheck:
-    """Ensures the working tree is clean before a task starts."""
-    
-    def check(self, project_root, task_id: str) -> list[Gap]:
-        try:
-            status = subprocess.check_output(["git", "status", "--porcelain"], cwd=project_root).decode()
-            if status.strip():
-                return [Gap(
-                    id=f"GAP-{task_id}-DIRTY-GIT",
-                    severity="high",
-                    gap_type="architecture_drift",
-                    task_id=task_id,
-                    description="Git working tree is dirty. Execution requires a clean state for checkpointing.",
-                    recommended_fix="Commit or stash your current changes before running the task.",
-                    blocking=True
-                )]
-        except FileNotFoundError:
-            logger.error("Git is not installed or not in PATH.")
-            return [Gap(
-                id=f"GAP-{task_id}-NO-GIT",
-                severity="high",
-                gap_type="architecture_drift",
-                task_id=task_id,
-                description="Git is not available. Cannot verify working tree cleanliness.",
-                recommended_fix="Install git and ensure it is in your PATH.",
-                blocking=True
-            )]
-        except subprocess.CalledProcessError as e:
-            logger.warning("Git status check failed: %s", e)
-            return [Gap(
-                id=f"GAP-{task_id}-GIT-ERROR",
-                severity="medium",
-                gap_type="architecture_drift",
-                task_id=task_id,
-                description=f"Git status check failed: {e}. Directory may not be a git repository.",
-                recommended_fix="Initialize a git repository with 'git init' before running tasks.",
-                blocking=True
-            )]
-        return []
+import subprocess
+import logging
+from devcouncil.domain.gap import Gap
+
+logger = logging.getLogger(__name__)
+
+class CleanGitCheck:
+    """Ensures the working tree is clean before a task starts."""
+
+    def _is_runtime_state(self, line: str) -> bool:
+        path = line[3:].strip().replace("\\", "/")
+        # DevCouncil manages the root .gitignore itself (ensure_gitignore runs on
+        # init and before every task), so it must not block execution.
+        return path.startswith(".devcouncil/") or path == ".gitignore"
+    
+    def check(self, project_root, task_id: str) -> list[Gap]:
+        try:
+            status = subprocess.check_output(["git", "status", "--porcelain"], cwd=project_root).decode()
+            dirty_lines = [line for line in status.splitlines() if line.strip() and not self._is_runtime_state(line)]
+            if dirty_lines:
+                return [Gap(
+                    id=f"GAP-{task_id}-DIRTY-GIT",
+                    severity="high",
+                    gap_type="architecture_drift",
+                    task_id=task_id,
+                    description="Git working tree is dirty. Execution requires a clean state for checkpointing.",
+                    recommended_fix="Commit or stash your current changes before running the task.",
+                    blocking=True
+                )]
+        except FileNotFoundError:
+            logger.error("Git is not installed or not in PATH.")
+            return [Gap(
+                id=f"GAP-{task_id}-NO-GIT",
+                severity="high",
+                gap_type="architecture_drift",
+                task_id=task_id,
+                description="Git is not available. Cannot verify working tree cleanliness.",
+                recommended_fix="Install git and ensure it is in your PATH.",
+                blocking=True
+            )]
+        except subprocess.CalledProcessError as e:
+            logger.warning("Git status check failed: %s", e)
+            return [Gap(
+                id=f"GAP-{task_id}-GIT-ERROR",
+                severity="medium",
+                gap_type="architecture_drift",
+                task_id=task_id,
+                description=f"Git status check failed: {e}. Directory may not be a git repository.",
+                recommended_fix="Initialize a git repository with 'git init' before running tasks.",
+                blocking=True
+            )]
+        return []

package/src/devcouncil/gating/checks/planned_files_check.py

@@ -1,32 +1,32 @@
-from devcouncil.domain.task import Task
-from devcouncil.domain.gap import Gap
-
-class PlannedFilesCheck:
-    """Ensures a task has legitimate files planned for modification."""
-    
-    def check(self, task: Task) -> list[Gap]:
-        gaps = []
-        if not task.planned_files:
-            gaps.append(Gap(
-                id=f"GAP-{task.id}-NO-FILES",
-                severity="high",
-                gap_type="task_not_implemented",
-                task_id=task.id,
-                description=f"Task {task.id} has no planned files. Agents won't know where to write code.",
-                recommended_fix="Update the task to include at least one planned file path.",
-                blocking=True
-            ))
-        
-        has_modify = any(pf.allowed_change in ["create", "modify", "delete"] for pf in task.planned_files)
-        if task.planned_files and not has_modify:
-            gaps.append(Gap(
-                id=f"GAP-{task.id}-READ-ONLY",
-                severity="medium",
-                gap_type="task_not_implemented",
-                task_id=task.id,
-                description=f"Task {task.id} only has read-only files. No changes can be made.",
-                recommended_fix="Grant 'modify' or 'create' permissions to at least one file.",
-                blocking=True
-            ))
-            
-        return gaps
+from devcouncil.domain.task import Task
+from devcouncil.domain.gap import Gap
+
+class PlannedFilesCheck:
+    """Ensures a task has legitimate files planned for modification."""
+    
+    def check(self, task: Task) -> list[Gap]:
+        gaps = []
+        if not task.planned_files:
+            gaps.append(Gap(
+                id=f"GAP-{task.id}-NO-FILES",
+                severity="high",
+                gap_type="task_not_implemented",
+                task_id=task.id,
+                description=f"Task {task.id} has no planned files. Agents won't know where to write code.",
+                recommended_fix="Update the task to include at least one planned file path.",
+                blocking=True
+            ))
+        
+        has_modify = any(pf.allowed_change in ["create", "modify", "delete"] for pf in task.planned_files)
+        if task.planned_files and not has_modify:
+            gaps.append(Gap(
+                id=f"GAP-{task.id}-READ-ONLY",
+                severity="medium",
+                gap_type="task_not_implemented",
+                task_id=task.id,
+                description=f"Task {task.id} only has read-only files. No changes can be made.",
+                recommended_fix="Grant 'modify' or 'create' permissions to at least one file.",
+                blocking=True
+            ))
+            
+        return gaps

package/src/devcouncil/gating/checks/requirement_coverage.py

@@ -1,26 +1,26 @@
-from devcouncil.domain.requirement import Requirement
-from devcouncil.domain.task import Task
-from devcouncil.domain.gap import Gap
-from typing import List
-
-class RequirementCoverageCheck:
-    """Detects requirements that are not mapped to any tasks."""
-    
-    def check(self, requirements: List[Requirement], tasks: List[Task]) -> List[Gap]:
-        task_req_ids = set()
-        for t in tasks:
-            task_req_ids.update(t.requirement_ids)
-            
-        gaps = []
-        for req in requirements:
-            if req.id not in task_req_ids:
-                gaps.append(Gap(
-                    id=f"GAP-PLAN-{req.id}-UNMAPPED",
-                    severity="high",
-                    gap_type="requirement_not_planned",
-                    requirement_id=req.id,
-                    description=f"Requirement '{req.title}' is not covered by any task.",
-                    recommended_fix="Decompose this requirement into one or more implementation tasks.",
-                    blocking=True
-                ))
-        return gaps
+from devcouncil.domain.requirement import Requirement
+from devcouncil.domain.task import Task
+from devcouncil.domain.gap import Gap
+from typing import List
+
+class RequirementCoverageCheck:
+    """Detects requirements that are not mapped to any tasks."""
+    
+    def check(self, requirements: List[Requirement], tasks: List[Task]) -> List[Gap]:
+        task_req_ids = set()
+        for t in tasks:
+            task_req_ids.update(t.requirement_ids)
+            
+        gaps = []
+        for req in requirements:
+            if req.id not in task_req_ids:
+                gaps.append(Gap(
+                    id=f"GAP-PLAN-{req.id}-UNMAPPED",
+                    severity="high",
+                    gap_type="requirement_not_planned",
+                    requirement_id=req.id,
+                    description=f"Requirement '{req.title}' is not covered by any task.",
+                    recommended_fix="Decompose this requirement into one or more implementation tasks.",
+                    blocking=True
+                ))
+        return gaps

package/src/devcouncil/gating/checks/secret_scan_check.py

@@ -1,34 +1,53 @@
-from typing import List
-from devcouncil.domain.gap import Gap
-from devcouncil.utils.redaction import SECRET_PATTERNS, redact_string
-
-class SecretScanner:
-    """Scans code diffs for potential secrets (API keys, tokens, etc.)."""
-    
-    def scan_diff(self, diff_content: str, task_id: str) -> List[Gap]:
-        gaps = []
-        lines = diff_content.splitlines()
-        current_file = "unknown_file"
-        
-        for i, line in enumerate(lines):
-            if line.startswith("+++ b/"):
-                current_file = line[6:]
-                continue
-                
-            # Only scan added lines in diff
-            if not line.startswith("+") or line.startswith("+++"):
-                continue
-                
-            for key_type, pattern in SECRET_PATTERNS.items():
-                if pattern.search(line):
-                    gaps.append(Gap(
-                        id=f"GAP-{task_id}-SECRET-{key_type.upper()}-{i}",
-                        severity="critical",
-                        gap_type="security_risk",
-                        task_id=task_id,
-                        description=f"Potential {key_type} found in {current_file} (diff line {i+1}).",
-                        evidence=[redact_string(line.strip())],
-                        recommended_fix="Remove the secret and use environment variables or a secret manager.",
-                        blocking=True
-                    ))
-        return gaps
+import re
+from typing import List
+from devcouncil.domain.gap import Gap
+from devcouncil.utils.redaction import SECRET_PATTERNS, redact_string
+
+# Captures the new-file starting line from a unified-diff hunk header (@@ -a,b +c,d @@).
+_HUNK_RE = re.compile(r"^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@")
+
+
+class SecretScanner:
+    """Scans code diffs for potential secrets (API keys, tokens, etc.)."""
+
+    def scan_diff(self, diff_content: str, task_id: str) -> List[Gap]:
+        gaps: List[Gap] = []
+        current_file = "unknown_file"
+        new_line_no = 0  # line number in the new file, tracked across hunks
+        counter = 0      # ensures unique gap ids
+
+        for line in diff_content.splitlines():
+            if line.startswith("+++ b/"):
+                current_file = line[6:]
+                continue
+            if line.startswith("+++") or line.startswith("---") or line.startswith("diff "):
+                continue
+            hunk = _HUNK_RE.match(line)
+            if hunk:
+                new_line_no = int(hunk.group(1))
+                continue
+            if line.startswith("-"):
+                continue  # removed line — does not advance the new-file counter
+            if line.startswith("+"):
+                for key_type, pattern in SECRET_PATTERNS.items():
+                    if pattern.search(line):
+                        counter += 1
+                        gaps.append(Gap(
+                            id=f"GAP-{task_id}-SECRET-{key_type.upper()}-{new_line_no}-{counter}",
+                            severity="critical",
+                            gap_type="security_risk",
+                            task_id=task_id,
+                            description=f"Potential {key_type} found in {current_file}:{new_line_no}.",
+                            evidence=[redact_string(line.strip())],
+                            recommended_fix="Remove the secret and use environment variables or a secret manager.",
+                            blocking=True,
+                            # Populate the routing fields so the security NextAction points
+                            # the agent straight at the file:line instead of forcing a re-grep.
+                            file=current_file,
+                            line=new_line_no,
+                        ))
+                new_line_no += 1
+                continue
+            # Context or blank line — advances the new-file counter.
+            new_line_no += 1
+        return gaps